WAF Release - 2026-08-26 - Emergency

This emergency release updates an existing Next.js remote code execution rule to identify CVE-2026-75604 and adds a new rule for remote code execution in the Next.js Image Optimizer via crafted AVIF images.

Key Findings

• CVE-2026-75604 affects Windows-hosted Next.js applications using both the Pages Router and App Router without Cache Components and can lead to unauthenticated remote code execution.
• GHSA-2xp9-vwfh-vxw4 affects the Next.js Image Optimizer and can lead to unauthenticated remote code execution when it optimizes an attacker-controlled AVIF image.

Impact

Next.js recommends updating to version 16.3.3 or 15.5.24 to address these vulnerabilities.

Ruleset · Rule ID · Legacy Rule ID · Description · Previous Action · New Action · Comments

Cloudflare Managed Ruleset · 2b6b94ec864d47f99630ecf72ca6cce3 · N/A · Next.js - Remote Code Execution - CVE:CVE-2026-75604 · Block · N/A · Rule metadata description refined. Detection unchanged.

Cloudflare Managed Ruleset · 18b22b0bd423423c945b3a0180256efe · N/A · Next.js - Image Optimizer Remote Code Execution via Crafted AVIF · N/A · Block · This is a new detection.